Why case-init.ps1 Requires auth.status=granted for ACT Operations: Security Gate Explained

The case-init.ps1 script enforces auth.status=granted as a mandatory security checkpoint to prevent unauthorized ACT operations, ensuring explicit permission verification and network readiness before any target interaction.

The case-init.ps1 script serves as the authorization gatekeeper in the reverse-skill framework. Before executing any destructive or probing commands against a target—collectively referred to as ACT operations—this PowerShell entry-point must generate the case's scope.md file and validate that the security context is fully established. This design protects both operators and target environments from accidental or unauthorized actions.

The Authorization Gate Policy in AGENTS.md

Per the repository's AGENTS.md, the workflow follows a strict sequence:

"对任何目标动手前：powershell -File skills/scripts/case‑init.ps1 生成 work/<case>/scope.md
auth.status=granted + network_profile 就绪前禁止 ACT"

This policy creates three layers of protection:

• Explicit Authorization – The $auth.status = "granted" flag signals verified permission to interact with the target
• Network Readiness – The network_profile must confirm VPN, proxy, or other required resources are configured
• Centralized Enforcement – All skill modules consult the same auth object, eliminating inconsistent access control

How case-init.ps1 Implements the Security Check

Located at skills/scripts/case-init.ps1, the script performs two critical functions:

1. Scope Generation – Creates work/<case>/scope.md containing case-specific metadata
2. Auth State Initialization – Sets $auth.status = "granted" only after validation succeeds

As implemented in zhaoxuya520/reverse-skill, downstream ACT scripts check this state before execution. The routing configuration in skills/config/routing.json ensures all skill modules—including reverse-engineering and penetration-testing tools—respect this same logic.

Correct Workflow vs. Blocked Execution

Proper Initialization Sequence

# Step 1: Initialize the case first

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/case-init.ps1 -Hint "example.com"

After completion, case-init.ps1 creates:

• work/<case>/scope.md – Case metadata file
• $auth.status = "granted" – Authorization flag
• $auth.network_profile = "ready" – Network readiness flag

Validated ACT Execution

# Step 2: Only now can ACT scripts run

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/act-some-tool.ps1

Failed Execution Without Authorization

Attempting ACT operations without initialization produces:

[!] AUTHORIZATION REQUIRED – please run case-init.ps1 and ensure auth.status=granted

Why This Design Prevents Privilege Escalation

The reverse-skill framework's safety-first philosophy relies on immutable case state. By centralizing the auth.status=granted check in case-init.ps1:

• Operators cannot accidentally execute commands against the wrong target
• Scripts cannot bypass authorization through parameter manipulation
• Audit trails are preserved through the generated scope.md file

All skill modules inherit this protection because they reference the same auth object defined at initialization.

Summary

• case-init.ps1 is mandatory before any ACT operation
• auth.status=granted requires explicit user permission verification
• network_profile confirmation ensures safe network connectivity
• Centralized enforcement in AGENTS.md prevents inconsistent security across skills
• Failed authorization produces clear, actionable error messages

Frequently Asked Questions

What happens if I run an ACT script without case-init.ps1?

The framework aborts immediately with the error: [!] AUTHORIZATION REQUIRED – please run case-init.ps1 and ensure auth.status=granted. No target interaction occurs.

Can I manually set auth.status=granted to bypass the check?

No—the auth object is instantiated and validated within case-init.ps1. Direct modification would violate the framework's security model and likely cause downstream script failures due to missing scope.md metadata.

Where is the authorization policy formally defined?

In AGENTS.md at the repository root, which documents the mandatory "对任何目标动手前" (before touching any target) workflow requiring both case-init.ps1 execution and auth.status=granted.

Does this apply to all reverse-skill modules?

Yes—skills/config/routing.json ensures consistent enforcement across reverse-engineering, penetration-testing, and all other skill categories in the repository.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}